> daily_signal(2026_09_11)
The company that scans your ID at the bar lost 150 million to hackers, California started licensing AI auditors, top AI spenders cut per-employee spend 10%, and an AI out-designed a cancer drug.
PickBits Daily Signal · Friday, September 11, 2026
// tl;dr
- A vendor that scans IDs at bars and dispensaries lost more than 153 million driver's licenses, plus passports and ID photos, to hackers. IDScan.net confirmed the breach; security reporter Brian Krebs found the haul for sale on a dark-web site, and the FBI is investigating. Count people, not records: one person shows up on many scans.
- California became the first state to require independent audits of AI and to license the auditors. Gavin Newsom signed SB 813 and AB 1405 on September 9, creating outside verifiers and a public state registry. The enforceable registration requirement does not begin until January 2029.
- The top 1% of AI spenders cut spend per employee almost 10% in a single month, to about $7,205. Ramp's August index ties it to a price war: effective token prices are down 41% since March, even as adoption rose. The catch: if the biggest buyers keep paying less, that is the revenue the data-center build-out was counting on.
- Memorial Sloan Kettering used AI to design a CAR-T binder that beat an approved drug in mice. The AI-designed version gave "complete control of the cancer"; the team built a model called CARPNN to guide it. It is a mouse study, not a human trial.
We have tracked the surveillance economy all year, the door scans and the age checks and the border face-reading, and this week the bill for it got a lot more concrete. The company that scans your ID at the bar lost more than 150 million of them to hackers, the Defense Secretary among the leaked. Honestly, I did not expect the biggest ID breach yet to come from a bar-and-dispensary vendor.
The rest of the day I am less sure about. The biggest AI buyers spent about 10% less per employee last month, the first hard sign the price of AI is falling faster than the spending it is supposed to justify. California decided someone independent should finally get to check the AI, and licensed the people who will. And at Sloan Kettering, an AI designed a cancer binder that beat the approved drug in mice, which is early, in animals, and honestly the most hopeful thing here.
Today: IDScan lost more than 150 million ID scans to hackers, Ramp clocked the biggest AI spenders paying 10% less per employee, California signed the first laws licensing AI auditors, and Memorial Sloan Kettering let an AI design a cancer binder that beat the approved drug in mice.
1. The company that scans your ID at the bar just lost more than 150 million of them to hackers.
The stolen set includes driver's licenses, passports, and photos of the IDs themselves, it is for sale on a dark-web site, and the FBI is investigating.
A copy of your driver's license may be sitting on a dark-web site right now, and it got there through the company that scans IDs at the bar and the dispensary. IDScan.net, a Louisiana company that bars and cannabis dispensaries use to check and authenticate customers' IDs, confirmed on September 10 that hackers stole customer data from its cloud. It had issued a breach notice days earlier, on September 4. Security reporter Brian Krebs found a dark-web site offering the stolen collection: more than 153 million driver's licenses from the US and Canada, about 10 million other ID cards, roughly 3 million travel documents such as passports, and 579,000 medical and marijuana-dispensary cards. The exposed fields include full names, government-document numbers, and photos of the IDs.
The FBI's New Orleans field office confirmed it is investigating, and the leaked data reportedly includes high-profile people such as Defense Secretary Pete Hegseth. One caveat before anyone panics: count people, not records. One person can appear on many scans, so the number of humans affected is well below that 153 million headline. IDScan says full access to the collection required payment and that it is notifying potentially affected people. It has not disclosed a ransom demand.
Why this matters: We have watched the surveillance economy build all year, from Flock's cameras to the border face-scans to health-record breaches by the millions, and this is the same problem, just from the vendor's side. The age check at the door and the ID scan at the dispensary now feed the same kind of vendor cloud, and "we scan to keep you safe" just turned into "we kept a copy of your passport until someone took it." This is the biggest bill yet for keeping every one of those scans in one company's cloud.
Action this week: Freeze your credit at all three bureaus. It's free, and it's the single move that blunts a stolen identity document. Then, the next time a venue scans you, ask the question almost nobody asks: do you keep this, and for how long. The real fix here, to my mind, is not tighter security at IDScan, it's a rule that says verify and discard, because you can't lose what you never stored.
techcrunch.com: ID verification giant IDScan confirms data breach with more than 150 million driver's licenses stolen (September 10, 2026)
krebsonsecurity.com: FBI probes service selling 153M driver's licenses (September 2026)
tomsguide.com: Over 150 million driver's licenses stolen in massive data breach, what to do now (September 2026)
2. California just became the first state to license the people who audit AI.
Two laws Newsom signed Tuesday create independent AI verifiers and a public registry of state-numbered auditors, but the enforceable part does not switch on until 2029.
Plenty of companies say they audit their AI, which usually means they audit it themselves. What almost never happens is someone independent checking the work. This week California made that a licensed job. On September 9, Governor Gavin Newsom signed two first-in-the-nation laws that make an outside referee a real role. SB 813, from Senator Jerry McNerney, sets up a framework for independent verification organizations to assess whether an AI system complies with state law. AB 1405, from Assemblymember Rebecca Bauer-Kahan, creates a state registry of AI auditors held to standards for independence, transparency, and integrity: the state issues each registered auditor a number, publishes their information, and lets people report auditor misconduct.
The catch is in the timing. The Government Operations Agency must stand up the AI Auditor Registry by January 1, 2029, and only from that date can no one conduct a "covered AI audit" without a state registration number. So the framework is law now, but the enforceable floor is three years out. Newsom said the quiet part himself, calling on the federal government "to do its part," which is Sacramento admitting one state cannot referee a national game alone. California's reach stops at its border, but I would not bet against other states copying whatever it writes first.
Why this matters: To me the registry matters more than the audits. A state handing each auditor a number, publishing who they are, and taking complaints treats checking AI like a licensed trade instead of a favor a company does for itself, and that is the part other states will copy. When I've asked vendors who audits their models, the honest answer has usually been "we do." This is the first law that treats that answer as unacceptable.
Action this week: Watch which organizations line up to register as California's first AI auditors once the list opens, because the first names in it set the standard for what "independent" means everywhere. And if you work anywhere near AI compliance, do not wait for 2029: the enforceable date is years away, so the leverage right now is in procurement terms and contracts that can demand an independent audit today, ahead of the law.
gov.ca.gov: Governor Newsom signs first-in-the-nation AI safeguards, calls on the federal government to do its part (September 9, 2026)
leginfo.legislature.ca.gov: AB 1405, AI auditor registry bill text (2026)
3. The biggest AI spenders just cut per-employee spend 10% in a single month.
It was not a pullback: token prices have fallen 41% since March, adoption actually rose, and one month is not yet a trend.
Something odd turned up in the AI spending data this month: at the very top spenders, the per-employee bill fell. Ramp, which watches card spending across more than 70,000 businesses, published its August AI Index on September 9. Among the top 1% of AI spenders on its platform, median spend per employee fell almost 10% in a single month, from about $7,976 in July to roughly $7,205 in August. And this was not companies quitting AI: adoption rose, with 56% of Ramp's customers paying for an AI product in August. It is the price collapsing, not the usage.
Ramp economist Ara Kharazian pins the drop largely on a price war. Average effective token prices fell to $0.68 per million in early September from a $1.15 peak in March, a 41% decline he attributes to OpenAI and Anthropic underbidding each other, "not just driving the price down, but driving spend down" at top-tier firms. The caveats are real and Ramp names them: August is a seasonal low, one month is not a trend, and the sample is Ramp's own customers. The part that worries me: if the heaviest buyers pay less per unit and less overall, that is the exact revenue the data-center build-out is counting on.
Why this matters: One month is not a trend, and the people who published this said so first. But the direction is the one to watch. We have tracked the AI build-out's bet through the ratepayer fights and the power bills, and it all rests on enterprises paying more over time. This is the first month the meter on the other side ticked down, and it did so at the exact firms whose spending the whole build-out is counting on.
Action this week: Before you renew any AI contract, pull your last three months of per-seat cost and re-baseline, because the vendor is quietly assuming you won't notice the floor dropped. Then get one thing in writing: will they pass the lower token price through, or keep the spread. My own experience is that the price you were quoted at signup is almost never the price the market is charging six months later.
techcrunch.com: AI spend per employee slumped at top firms in August, summer doldrums or a warning sign (September 9, 2026)
ramp.com: AI Index, August 2026 (September 2026)
the-decoder.com: Top AI spenders cut per-employee costs by nearly 10 percent in August (September 2026)
PickBits Daily Signal is free. If it lands in your inbox every day and it is worth something to you, the best way to support it is to forward it to someone who would read it. Subscribe today!
4. An AI at Memorial Sloan Kettering designed a cancer binder that beat the approved drug in mice.
It gave "complete control of the cancer" where the existing clinical product could not, and it's still a mouse study, years from a patient.
For anyone fighting multiple myeloma, or loving someone who is, this one is for you. Researchers at Memorial Sloan Kettering used AI to design the "binder" of a CAR-T therapy, the part that grabs onto a tumor marker, and the AI-designed version outperformed an approved clinical product in mice. Targeting BCMA, a marker on multiple-myeloma cells, the team used two AI tools to generate roughly one million candidate binders, narrowed them to 100 to 200, then built a custom model called CARPNN that learns from lab results how small sequence changes affect a CAR-T's performance. Their result, in their words: "complete control of the cancer using our AI-designed binder, whereas the existing clinical product could not limit tumor growth." The model even surfaced design rules humans had not spelled out, such as how a binder's electrical charge affects when the therapy fires.
The work was published in Nature Biomedical Engineering on September 10, led by researchers including Arthur Chow, Hoyin Chu, and Ruofan Li. It is a real change in what AI does in medicine. We have covered plenty of stories where AI read your scan or cleaned up your chart; here the AI designed the therapy itself, rather than analyzing someone else's data, though so far only in mice. And the caveat is the whole story: this was done in mice, not people, and plenty of things that cured a mouse have failed a human.
Why this matters: A co-author, Dr. Lareau, described the method as generating a million answers in ChatGPT and then asking a different model, like Claude, to grade them, which is a fair picture of where this actually is. This is the most genuinely exciting thing on today's slate, and I think the one most likely to be oversold. The tell will be whether anyone can reproduce it outside one lab.
Action this week: Watch for one thing before you get your hopes up: whether this binder gets picked up for a real clinical trial. Announced is not funded, and funded is not running, and the graveyard of cancer cures is full of things that worked beautifully in a mouse. Share this with anyone waiting on better myeloma options, because the honest version of this news is still worth having.
nature.com: Sequence and structural determinants of efficacious de novo chimaeric antigen receptors (Nature Biomedical Engineering, September 2026)
medicalxpress.com: AI-designed proteins outperform an approved CAR-T binder targeting BCMA in mice (September 10, 2026)
» What to watch this week
- Whether IDScan names the venues and retailers whose scans were in the breach. Right now affected people cannot easily tell if their ID was in the set, and that disclosure is the difference between a freeze-your-credit warning and an abstract headline.
- Which organizations register as California's first licensed AI auditors. The first names in the registry, and how "independent" gets defined, set the template every other state will copy.
- Whether Ramp's September index shows the per-employee drop holding or reversing. One slow month proves nothing; two would turn "summer doldrums" into a real signal about AI's price collapse.
- Whether MSK's AI-designed binder gets picked up for a clinical trial. Announced is not funded and funded is not running; the next real milestone is a trial number, not a press release.
Tomorrow's signal lands here.